TL;DR
- Detection is a research discipline, not a rule library. A rule scoped to one indicator starts decaying the day you ship it.
- Vega detection packages are what that research produces: end-to-end coverage of one threat across every kill-chain stage and data source, revised continuously.
- ClickFix proves the model. One technique adopted by both financially motivated criminals and nation-state actors, spanning Windows, macOS, and Linux.
- In the first half of 2026, the Vega ClickFix package caught incidents across industries, operating systems, and payloads, containing each one before the payload could run or spread.
A detection rule is obsolete the day you ship it.
The rule you write today is scoped to what you know today: one file hash, one domain, one command string. Adversaries iterate faster than any team can maintain a rule library. Infrastructure rotates, payloads evolve, new variants ship weekly.
The teams that keep pace treat detection as a research discipline, not a rule library. They hunt live threats, study how campaigns operate across the kill chain, and feed what they learn straight back into coverage. Detection becomes an engineering practice with a research engine behind it: continuous, threat-centric, built to evolve. That is the Post-SIEM approach to coverage, and the thinking behind Vega's Detection Packages.
What That Research Produces: Detection Packages
At Vega, coverage is organized into detection packages. A package is a curated set of detection logic that gives end-to-end visibility into a single threat, built by the same research team that tracks it in the wild. Related detections evolve together as one package, not one rule at a time.
Where a traditional rule asks, "Did this specific activity occur?", a detection package asks, "Is this threat active in my environment at any stage of the kill chain?"
Two Ways to Package a Threat
Threat-actor packages cover one actor's tactics, techniques, and procedures (TTPs) across the full lifecycle, from phishing delivery to credential theft to cloud exfiltration, as one coordinated set rather than disconnected rules.
Threat-type packages cover a methodology across many variants and operators. A ransomware package covers the pre-encryption staging common to many criminal groups, independent of who is behind it.
What a Package Delivers
- Layered coverage: multiple stages of an attack, so activity missed at one point is caught at another.
- Coverage across data sources: multiple telemetry types, so a gap in one source doesn't become a blind spot.
- Continuous revision: as actors adapt and new variants emerge, detections are added, gaps close, and coverage expands.
Packages like this are only possible because of Vega's Security Analytics Mesh (SAM): federated analytics across every data source in your environment, without centralizing the data.
ClickFix: One Technique, Every Platform, Every Actor
Take ClickFix. It spans multiple platforms, execution paths, and campaign variants. That makes it nearly impossible to cover with isolated detections, and a perfect test of package-based coverage.
What Is ClickFix?
ClickFix is a fast-growing social engineering technique. A malicious webpage instructs the user to copy a command and paste it into the Windows Run dialog, File Explorer address bar, or a terminal. No exploit, no attachment, no unsolicited download. The attacker shifts the execution step onto the victim, who believes they are completing a legitimate task.
Here is what makes it a research problem: both financially motivated criminals and nation-state actors have adopted it, a rare convergence on one method. Vega tracked a criminal campaign using EtherHiding and 2,000+ compromised sites to push a remote access trojan (RAT). Proofpoint documented four nation-state groups (including Iran's MuddyWater and North Korea's Kimsuky) using it for persistent espionage. Same clipboard trick, opposite endgames.
Same Trick, Different Telemetry
ClickFix runs on Windows, macOS, and Linux, and each platform leaves different evidence. Cover one and you're blind on the others.
- Windows: the pasted command runs as a child of explorer.exe (usually PowerShell or cmd.exe), with the RunMRU registry key confirming user-initiated execution.
- macOS: the command runs under zsh or bash as a child of Terminal.app, often chaining curl downloaders, AppleScript, and password validation via dscl authonly.
- Linux: APT36's delivery uses the same clipboard paste to target bash, surfacing through Sysmon for Linux (Event ID 1) or auditd, with different field names again.
One execution mechanism, three telemetry models. Holding that together is exactly what a package is built to do.
Correlation Is What Kills False Positives
No single source is enough. Browser telemetry shows a user copied content from a suspicious site, but not that it ran. Endpoint telemetry catches the execution, but can't always separate a lure from legitimate admin work. Network telemetry adds the payload downloads and command-and-control (C2) traffic that follow. The package correlates all of it. That is what SAM does, running the analytics where the data already lives.
It works in two stages. Stage 1 flags the user-driven execution itself: process creation, command-line patterns, and the OS artifacts above, tied to a recent copy from a suspicious domain on the same host. Stage 2, the behavioral layer, reaches past the initial event to behavior that stays consistent across operators whatever the payload: second-stage retrieval, malicious browser extensions, antivirus-exclusion changes, and the use of LOLBins (living-off-the-land binaries) or DLL sideloading as part of the delivery chain.
Proof in the Wild
Coverage this durable comes only from continuous hunting. Vega tracks ClickFix across monitored environments and the wider threat landscape, folding each finding back into the package. In the first half of 2026 alone, it caught incidents across industries, operating systems, and payloads.
Windows CrashFix. A CrashFix lure (a ClickFix variant posing as a Windows troubleshooting fix) tricked a user into pasting a command that abused finger.exe, a trusted Windows binary, to fetch a payload and slip past download restrictions. This illustrates a common LOLBin (Living Off the Land Binary) technique: the malicious payload is retrieved by a process most environments trust. An IOC sweep against known CrashFix infrastructure caught this one: one layer of the package doing its job, while the behavioral detections cover the variants that rotate infrastructure to dodge exactly that kind of sweep.
AI dev-tool impersonation. Within six weeks, two organizations were hit by lures impersonating Claude-related developer tools. One rebuilt a downloader at runtime with character-substitution obfuscation before piping it to the shell. Another used a curl | base64 -D pipe to decode a payload in memory. Different detection paths caught each: an unusual Script Editor process relationship, and an IOC match on the download domain. Both were blocked before the payload ran.
macOS SHub Stealer. A user pasted a Terminal command that curled a shell script and fetched an AppleScript payload, which ran external IP discovery and threw a fake macOS authentication dialog to steal the local password (validated via dscl). Detection logic covering ClickFix loader-retrieval patterns caught it during the download stage, and the endpoint was isolated within minutes with no lateral spread.
Coverage Is Never "Done"
Detection packages are living artifacts. Adversaries constantly adapt, and coverage that was comprehensive at publication develops gaps as campaigns evolve. The Vega ClickFix package has been revised multiple times since release, and it will be again. That is the point: research-driven packages absorb new variants, extend to new execution paths, and correlate across sources instead of leaning on isolated indicators. The goal was never a rule for one campaign. It is durable coverage of a threat.
Part 2 of this series goes deep on post-ClickFix behavioral patterns: payload behaviors observed across live threat infrastructure, with detection logic and case studies from active threat hunting. Want to see the package run against your own data? Book a demo.
Frequently Asked Questions (FAQs)
1. What is a detection package, and how is it different from a traditional detection rule? A detection package is a curated collection of detection logic designed to cover a specific threat across every stage of the kill chain, not just a single technique or indicator. Where a Legacy SIEM rule asks, "Did this specific activity occur?", a detection package asks, "Is this threat active in my environment at any stage of the kill chain?" The difference is coverage: a package spans multiple data sources, execution paths, and threat variants simultaneously, and evolves as the threat does.
2. Why is ClickFix difficult to detect with standard security tools? ClickFix shifts execution to the victim. There is no malicious file download, no exploit, and no unsolicited attachment. The user copies and pastes attacker-provided commands, so early-stage activity often looks indistinguishable from legitimate administrative behavior. Effective detection requires correlating signals across browser telemetry, endpoint process creation, and network activity simultaneously, a correlation model Legacy SIEM approaches were not built for.
3. Does the Vega ClickFix detection package cover macOS and Linux, or just Windows? It covers all three. Windows, macOS, and Linux each use different execution paths and generate different telemetry. Windows activity may surface through process telemetry and RunMRU registry artifacts, while Linux and macOS variants rely on Terminal-based execution through shells such as zsh, bash, or sh. The package accounts for these platform-specific differences while maintaining visibility into the shared clipboard execution mechanism.
4. How does Vega reduce false positives in ClickFix detection? Correlating signals across multiple telemetry sources is what separates high-confidence ClickFix detections from noise. Browser telemetry confirms that clipboard content came from a suspicious domain, endpoint telemetry confirms that the content was executed, and network telemetry reveals the payload retrieval or C2 communication that follows. Vega's Security Analytics Mesh federates these signals across data sources without centralizing the data, enabling high-fidelity detections that fire on correlated evidence, not single-source signals, which is what drives false positives down.
5. How often are Vega detection packages updated as threats evolve? Detection packages are living artifacts, updated continuously as threat actors adapt their tooling, infrastructure, and techniques. In the Post-SIEM model, coverage gaps that open as campaigns evolve are closed in real time through new detections, not at the next annual rule review. The Vega ClickFix package has been revised multiple times since its initial release, incorporating new variants like CrashFix, expanding coverage to macOS and Linux execution paths, and adding detection logic from active threat hunting.
